Data protection

1. What personal data do we collect?

We always collect personal data directly from the data subject, whether through forms, questionnaires, interviews, platforms specifically designed for data collection, physically distributed lists, or records made during meetings and activities.

We also process data such as cookies, log files, location data and device data, which are collected automatically by our servers. In such cases, the processing is temporary and takes place in accordance with the terms set out below.

In certain situations, we may process personal data shared by institutional partners or platforms contracted to facilitate projects, campaigns, donations, audits or legal obligations. That said, under no circumstances do we obtain or purchase information from third-party databases for commercial purposes.

1.1. Personal data

The information we collect may include:

• When registering and enrolling individuals in Instituto Elos’s social projects or programmes, and when mapping networks related to these programmes: personal identification data, personal characteristics, affiliations, education, occupation, video recordings, images and voice recordings;
• When collecting information as part of the methodology or other aspects of Instituto Elos’s social projects and programmes, whether before, during or after the period in which these activities take place: personal identification data, financial data, personal characteristics, personal habits, family composition, education and occupation, and video and image recordings;
• In selection processes, community calls for proposals or financial support initiatives: data required for eligibility assessment and, where applicable, information required for compliance purposes and to verify compliance with legal or contractual obligations;
• When registering with Instituto Elos’s donor programmes, personal identification details, financial information, personal characteristics, family composition, education and occupation;
• In the records of community gatherings and meetings, personal identification details, educational background and occupation, as well as images and voice recordings;
• When registering on our Gaming Platform and other digital platforms, personally identifiable information, personal characteristics, personal habits, image and voice;
• In administrative proceedings, data relating to personal identification, financial circumstances, family composition, personal characteristics, judicial/administrative/criminal proceedings, education, occupation and health.

1.2. Sensitive personal data

We are committed to taking extra care when processing sensitive data, and we only carry out such processing in accordance with the LGPD, namely: (i) subject to the specific consent of the data subject or their legal guardian; or (ii) in cases where it is essential for the operation and for our organisation, in accordance with the Law.

Such information may include:

(i) In the enrolment and registration of individuals in Instituto Elos’s social projects or programmes, and in the mapping of networks relating to these programmes:

• Data revealing racial or ethnic origin;
• Data revealing religious beliefs;
• Data revealing membership of a religious organisation;
• Data revealing political affiliation or philosophical beliefs;
• Data relating to health or sex life.

(ii) When collecting information as part of the methodology or other aspects of Instituto Elos’s social projects and programmes:

• Data revealing racial or ethnic origin;
• Data revealing membership of a religious organisation.

(iii) When registering on our Gaming Platform and other digital platforms:

• Data revealing racial or ethnic origin;
• Data revealing religious beliefs;
• Data revealing membership of a religious organisation;
• Data revealing political affiliation or philosophical beliefs;
• Data relating to health or sex life.

(iv) In administrative proceedings:

• Data revealing racial or ethnic origin;
• Data revealing trade union membership;
• Data relating to health or sex life.

Where personal data relating to individuals under the age of 12 is processed, we require the specific and explicit consent of a parent or legal guardian, in accordance with current legislation.

1.3. Cookie Policy and other data collected automatically

Cookies. Cookies are small text files sent by a web server to your device, which store information relating to the identification of your device and other details associated with it whilst you are browsing the website.

Cookies are used to enhance your experience when using our website, as well as to enable user tracking, as they identify you and allow information about your visits to our website to be remembered. By accessing our website and consenting to the use of cookies, you acknowledge that you are aware of and accept the use of a system for collecting browsing data through the use of cookies on your device.

You can, at any time and free of charge, change your permissions, block or refuse cookies, depending on your browser settings. However, withdrawing your consent for certain cookies may prevent some features of the platform from working correctly.

In some cases, we also use cookies provided by trusted third parties. This website uses Google Analytics, which is one of the most widely used and trusted analytics solutions on the web, to help us understand how you use the site and how we can improve your experience. These cookies may track details such as how long you spend on the site and the pages you visit, so that we can continue to produce engaging content. For further information about Google Analytics cookies, please see the official Google Analytics page.

Log files. Our servers may record certain information sent by your web browser. These logs may include various details about your browsing activity, such as your IP address, browser type, pages viewed and URLs, the number of clicks, how you interact with links, and other information.

Location data and device identification. This information may be collected when you access the website via a mobile device. This may include your country of location and similar information regarding the location and identification of your device. This data does not allow you to be identified on its own, and if you disable its sharing, some features of the website may not work correctly.

2. Why do we use personal data?

We only use personal data when strictly necessary. For us, the data we collect is essential for the following:

• When enrolling and registering individuals in the Instituto Elos’ social programmes, and when mapping the network associated with these programmes: to gain a better understanding of the individual, their interests, profile and suitability for the relevant programme; to identify the needs of the participating public; to collect data to measure Instituto Elos’s performance, in the event of audits and for presentation to future funders; to use for advertising and promotional purposes in the newsletter, whilst respecting the data subject’s anonymity unless their identification has been authorised;
• When collecting information as part of the methodology or other aspects of Instituto Elos’s social projects and programmes: to carry out assessments of communities, using a range of information about their members, with the aim of facilitating dialogue between institutional partners and the community, and enabling the social work of institutional partners; mapping communities to facilitate the Instituto Elos’s social work in the area; collecting data to measure the Instituto Elos’s performance, for the purposes of audits and for presentation to future funders; and to structure new projects based on aggregated data and strategic analyses.
• In selection processes, community calls for proposals or financial support initiatives: to carry out eligibility and compliance assessments where required by legal or contractual obligations of funding partners.
• In relation to Instituto Elos’s donor programme records and records of community gatherings and meetings: to monitor figures and measure impact for the purposes of improvement and audits; to maintain relationships with donors, participants and members of the communities involved in the projects; to undertake fundraising and utilise institutional media to publicise activities and strengthen the organisation’s mission.
• When registering on our Gaming Platform and other digital platforms: for educational purposes, as it is through this process that we foster the development of potential and encourage active participation, whilst also building a sense of belonging within the group that is formed;
• In administrative procedures: for the drafting and implementation of contracts, the provision of services, and compliance with tender and audit processes.

All processing of personal data has as its legal basis one of the grounds set out in the LGPD. In our operations, these are: (i) obtaining the data subject’s consent; (ii) compliance with legal obligations; (iii) the performance of a contract or pre-contractual measures to which the data subject is a party; and (iv) our legitimate interest.

For every operation carried out, we assess the most appropriate legal basis, taking into account the nature of the activity, the data subject’s legitimate expectations and the institution’s ethical commitment. Except in cases where data processing is legally required of us, we always obtain the data subject’s prior consent, including by informing them of the contents of this Privacy Policy.

By taking part in our programmes or providing data in any of these circumstances, and by confirming that you are aware of the terms of this Policy and of your rights, you are consenting to the continued processing of your data in accordance with the terms set out herein.

3. How do we use personal data?

The personal data collected is retained in our databases only for as long as is necessary, taking into account the type of information, its purpose and any other applicable requirements.

Our staff are instructed, and our systems are configured, to continuously analyse and delete out-of-date and unused information within a reasonable timeframe.

Consequently, unless the retention of such data is required to comply with a legal or regulatory obligation, the processing of personal data ceases in the following circumstances: (i) upon verification that the purpose has been achieved or that the data is no longer necessary or relevant to the specific intended purpose; (ii) upon expiry of the processing period; (iii) at the data subject’s request, in the exercise of their right to withdraw consent, provided that the public or legal interest is safeguarded; (iv) following any decision by the ANPD.

Generally speaking, please be aware that your data will be retained for as long as your relationship with Instituto Elos continues. When it is no longer required, either for the purposes of our relationship or for legal and regulatory purposes, it will be deleted from our databases or anonymised.

3.1. When we share data

The only circumstances in which we will share personal data in our possession are as follows:

• Where necessary for audience profiling for new projects;
• To enable our institutional partners to carry out social work in the communities and regions involved in our projects, including through the consultation of diagnostic reports;
• To facilitate eligibility assessments or compliance procedures and checks required by legal or contractual obligations entered into with funding partners;
• To process documents and financial transactions via international platforms;
• At the request of the account holder;
• Where authorised by the data subject by means of an explicit consent form;
• For the purposes of financial reporting, audits, and compliance with legal or regulatory requirements;
• For institutional publicity in the media and on digital platforms, subject to the necessary authorisation;
• For the use of technology platforms required for project management, fundraising, document signing, auditing, accounting, content hosting, institutional communications and relationship management;
• To protect our interests in the event of a dispute, including in legal proceedings;
• By court order or at the request of administrative authorities with the legal power to make such a request.

That said, we may disclose information necessary to fully achieve the objectives of our projects or for another legitimate reason. In such cases, personally identifiable data will be transmitted in an anonymised or encrypted form. Where this is not possible, Instituto Elos requires the partners involved to take responsibility for processing the data for specific purposes, in the best interests of the data subjects and in an ethical manner.

Some of the third parties with whom we share your data may be based in, or have facilities located in, foreign countries. In such cases, your personal data will be subject to the General Data Protection Act and the relevant data protection legislation in force in the country where the processing takes place. Instituto Elos undertakes to work only with third parties that comply with local data protection guidelines.

4. How do we keep your data secure?

Through technical and administrative measures, we protect the personal data under our care from a range of risks. We work exclusively with systems that have sufficient security features to meet the requirements of the LGPD and other regulatory standards, and we adopt best practices in our internal management to prevent security incidents. These measures include:

• restricting access to data on a need-to-know basis;
• a confidentiality agreement for all those with access to the data;
• regulatory guidelines on authorisation for the use of images and voice recordings, in accordance with the applicable legislation;
• clear opt-out mechanisms in communication groups and broadcasting networks;
• the adoption of objective and non-discriminatory criteria in eligibility and compliance assessment procedures;
• storage on secure and suitable platforms;
• anonymisation and encryption of files that require long-term storage beyond 7 years;
• regular training and induction for staff on best practice in data protection.

We would like to emphasise that no transaction is entirely risk-free. It is possible that, despite all our security protocols, incidents arising solely from the fault of third parties or from unforeseeable circumstances may occur. In the event of security incidents that may pose a risk or cause significant harm to any data subject, we will notify those affected and the ANPD of the incident, in accordance with current legislation.

4.1. Accountability and governance

We are committed to implementing effective measures that demonstrate compliance with the LGPD and other personal data protection regulations. We are also committed to demonstrating the effectiveness of these measures.

Whenever a new operation involving the processing of personal data is launched within our organisation, we identify the necessary actions, monitor their implementation across each team and by the staff members involved, and establish detailed workflows to ensure compliance, in line with the concept of ‘privacy by design’.

In the event of a security incident, Instituto Elos has an Incident Response Plan, in accordance with current legislation, which includes tracing the event and the perpetrator responsible for the breach, as well as the appropriate measures and guidelines for carrying out the legally required notifications.

5. What are your rights as a data subject?

Data subjects are guaranteed the following rights, amongst others set out in the LGPD and in this Privacy Policy:

• To access your data, either in a simplified form or in a clear and comprehensive format, covering both confirmation of whether your data is being processed and easy, free access to information on the nature and duration of the processing, as well as the full scope of your Personal Data;
• To correct your data, by requesting that it be accurate, clear, relevant and up to date, as necessary and in order to fulfil the purpose for which it is processed;
• To restrict your data where it is unnecessary, excessive or processed in breach of the law, by means of anonymisation, blocking or erasure;
• Request the portability of your data by means of a report detailing the personal data that Instituto Elos holds about you;
• To anonymise or delete your data if it is unnecessary, excessive or processed in breach of the rules;
• Find out about the option not to give your consent or to withdraw it, and about the consequences of refusing to do so, within the limits of the law.

Data subjects are also guaranteed the rights to security and protection against harm; the relevant technical and administrative measures may also be accessed free of charge at any time.

All these rights can be exercised by contacting our DPO using the form at the top of this page.

6. Applicable legislation

This Privacy Policy is governed by and strictly complies with the legislation relating to Federal Law No. 13.709/18, the General Data Protection Law (“LGPD”), and must be interpreted in accordance with it and the other provisions of Brazilian law.

6.1. Definitions

6.2. Principles

We are committed to adhering to the following principles in all our operations involving the processing of personal data, in accordance with Federal Law No. 13.709/18, the General Data Protection Act (“LGPD”):

7. Who is responsible for and implements this Privacy Policy

Our Data Protection Officer (DPO) is named at the top of this page and is responsible for ensuring that Instituto Elos operates in accordance with the LGPD and other data protection regulations, safeguarding users’ information through ethical and transparent practices.

This Privacy Policy forms part of a data protection programme that encompasses all of Instituto Elos’s activities. As such, its guidelines are implemented by all our managers, staff, partners and other individuals involved in our activities. Everyone in our organisation is briefed on their responsibility to prevent risks in data processing, and we are committed to doing our utmost to foster a proactive and informed culture of privacy and data protection.

You can contact the DPO to resolve any issues relating to this matter.

8. Updates to this Privacy Policy

This Privacy Policy was updated to its current version in February 2026.

We reserve the right to revise this Privacy Policy at any time by updating this publication, whether due to legal changes or updates to our internal guidelines. Any changes will take effect from the date of their publication on our website, and we will always notify our data subjects of any changes made.

We reaffirm our commitment to privacy and the protection of personal data, both to comply with the law and to help create a safer environment for us all.